Memory Exhaustion in FreeRDP via RD Gateway

Executive Summary

FreeRDP before version 3.32.2 has a memory allocation flaw in the rdg_receive_packet function. A malicious RD Gateway can exploit this by sending a specially crafted eight-byte header with a packet length of 0x7FFFFFFF (2 GiB) before tunnel authentication. This forces the client to allocate excessive memory, leading to pre-authentication denial of service.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires monitoring for unusual memory allocation patterns or network traffic targeting FreeRDP services. Check for FreeRDP versions before 3.32.2 using package managers like 'apt list --installed | grep freerdp' or 'rpm -qa | grep freerdp'. Inspect network traffic for RD Gateway packets with malformed headers or excessive size declarations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause denial of service by crashing or freezing FreeRDP clients when processing malicious RD Gateway traffic. Users may experience application crashes, system slowdowns, or inability to establish remote desktop connections.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update FreeRDP to version 3.32.2 or later. If updating is not possible, restrict network access to FreeRDP services using firewalls or disable RD Gateway functionality until patched. Monitor system memory usage for signs of exhaustion.

Useful 0 Not Useful 0